Fix/debian20241107

[a-skr]

Description:

• fix system_with_kernel applicability for debian derived operating systems
• fix accounts_users_home_files_groupownership bash remediation to handle symlinks properly
• fix accounts_users_home_files_ownership bash remediation to handle symlinks properly

edit: similar issue fixed in accounts_users_home_files_permissions

system_with_kernel

debian/ubuntu packages have different names than in the redhat world. We now check against the correct packages.

There was an error in the grep expression that would match both "installed" and "not-installed", so any system would be identified as having a kernel.

accounts_users_home_files_...

Add a --no-dereference option in bash remediation so that the remediation applies to the symlink and not to the linked file (if relevant, this last file is already handled as a regular file).

[openshift-ci]

Hi @a-skr. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_users_home_files_groupownership' differs.
--- xccdf_org.ssgproject.content_rule_accounts_users_home_files_groupownership
+++ xccdf_org.ssgproject.content_rule_accounts_users_home_files_groupownership
@@ -5,5 +5,5 @@
     # Only update the group-ownership when necessary. This will avoid changing the inode timestamp
     # when the group is already defined as expected, therefore not impacting in possible integrity
     # check systems that also check inodes timestamps.
-    find $home_dir -not -group $group -exec chgrp -f $group {} \;
+    find $home_dir -not -group $group -exec chgrp -f --no-dereference $group {} \;
 done

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_users_home_files_ownership' differs.
--- xccdf_org.ssgproject.content_rule_accounts_users_home_files_ownership
+++ xccdf_org.ssgproject.content_rule_accounts_users_home_files_ownership
@@ -4,5 +4,5 @@
     # Only update the ownership when necessary. This will avoid changing the inode timestamp
     # when the owner is already defined as expected, therefore not impacting in possible integrity
     # check systems that also check inodes timestamps.
-    find $home_dir -not -user $user -exec chown -f $user {} \;
+    find $home_dir -not -user $user -exec chown -f --no-dereference $user {} \;
 done

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_users_home_files_permissions' differs.
--- xccdf_org.ssgproject.content_rule_accounts_users_home_files_permissions
+++ xccdf_org.ssgproject.content_rule_accounts_users_home_files_permissions
@@ -3,5 +3,5 @@
     # Only update the permissions when necessary. This will avoid changing the inode timestamp when
     # the permission is already defined as expected, therefore not impacting in possible integrity
     # check systems that also check inodes timestamps.
-    find "$home_dir" -perm /7027 -exec chmod u-s,g-w-s,o=- {} \;
+    find "$home_dir" -perm /7027 \! -type l -exec chmod u-s,g-w-s,o=- {} \;
 done

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_home_directories' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_home_directories
+++ xccdf_org.ssgproject.content_rule_file_permissions_home_directories
@@ -3,5 +3,5 @@
     # Only update the permissions when necessary. This will avoid changing the inode timestamp when
     # the permission is already defined as expected, therefore not impacting in possible integrity
     # check systems that also check inodes timestamps.
-    find "$home_dir" -maxdepth 0 -perm /7027 -exec chmod u-s,g-w-s,o=- {} \;
+    find "$home_dir" -maxdepth 0 -perm /7027 \! -type l -exec chmod u-s,g-w-s,o=- {} \;
 done

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_home_dirs' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_home_dirs
+++ xccdf_org.ssgproject.content_rule_file_permissions_home_dirs
@@ -3,5 +3,5 @@
     # Only update the permissions when necessary. This will avoid changing the inode timestamp when
     # the permission is already defined as expected, therefore not impacting in possible integrity
     # check systems that also check inodes timestamps.
-    find "$home_dir" -maxdepth 0 -perm /7027 -exec chmod u-s,g-w-s,o=- {} \;
+    find "$home_dir" -maxdepth 0 -perm /7027 \! -type l -exec chmod u-s,g-w-s,o=- {} \;
 done

[codeclimate]

Code Climate has analyzed commit d18e07f and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 60.9% (0.0% change).

View more on Code Climate.